Skip to content

Bump the backend-prod group across 2 directories with 7 updates#580

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/maven/backend-prod-535e11cf65
Closed

Bump the backend-prod group across 2 directories with 7 updates#580
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/maven/backend-prod-535e11cf65

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 20, 2026 •
edited
Loading

Bumps the backend-prod group with 7 updates in the / directory:

Package From To
org.springframework.boot:spring-boot-starter-parent 3.5.11 3.5.12
software.amazon.awssdk:s3 2.42.7 2.42.17
org.springframework.security:spring-security-config 6.5.8 6.5.9
org.springframework.security:spring-security-core 6.5.8 6.5.9
org.springframework.security:spring-security-crypto 6.5.8 6.5.9
org.flywaydb:flyway-mysql 12.0.3 12.1.1
org.projectlombok:lombok 1.18.42 1.18.44

Bumps the backend-prod group with 7 updates in the /server directory:

Package From To
org.springframework.boot:spring-boot-starter-parent 3.5.11 3.5.12
software.amazon.awssdk:s3 2.42.7 2.42.17
org.springframework.security:spring-security-config 6.5.8 6.5.9
org.springframework.security:spring-security-core 6.5.8 6.5.9
org.springframework.security:spring-security-crypto 6.5.8 6.5.9
org.flywaydb:flyway-mysql 12.0.3 12.1.1
org.projectlombok:lombok 1.18.42 1.18.44

Updates org.springframework.boot:spring-boot-starter-parent from 3.5.11 to 3.5.12

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v3.5.12

🐞 Bug Fixes

  • EndpointRequest request matcher for health groups is too complex #49648
  • "/cloudfoundryapplication" web path is not limited to Actuator #49645
  • RSocket exposes duplicate endpoint for websocket setups #49592
  • Fix EndpointRequest.toLinks() when base-path is '/' #49591
  • SpringBootContextLoader mentions class that no longer exists in message for classes or locations assertion #49518
  • "spring.main.cloud-platform=none" does not disable cloud features #49478
  • Using @AutoConfigureWebTestClient prevents separate configuration of spring.test.webtestclient.timeout from taking effect #49340
  • Ordering of 'spring.config.import' is inconsistent when defined in environment or system properties #49324
  • RouterFunctions descriptions in Actuator do not support nesting #49289
  • Maven plugin does not set '-parameters' option when processing AOT code #49268
  • SSL support with Docker Compose does not work as documented #49210
  • Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49055

📔 Documentation

  • List all supported colors when describing color-coded log output #49561
  • Clarify that running is the only supported input state when triggering a Quartz job through the Actuator endpoint #49506
  • Tutorial in the reference guide has outdated instructions #49411
  • Javadoc of JettyHttpClientBuilder refers to the wrong type #49364
  • Example spring-devtools.properties file is shown in the wrong format #49357
  • Mention using org.springframework.boot.aot Gradle plugin directly for AOT processing with the JVM #49307
  • Update CLI's INSTALL.txt to reflect Groovy no longer being bundled #49297
  • JDK requirement for the CLI still refers to Java 8 #49290
  • Java and Kotlin samples of an environment post processor are inconsistent #49282
  • Document additional repositories required for shibboleth.net #49260
  • Clarify inferred relationships between OAuth 2 registrations and providers #49240

🔨 Dependency Upgrades

  • Upgrade to DB2 JDBC 12.1.4.0 #49544
  • Upgrade to Hibernate 6.6.44.Final #49457
  • Upgrade to Jakarta XML WS 4.0.3 #49458
  • Upgrade to JBoss Logging 3.6.3.Final #49630
  • Upgrade to Jetty 12.0.33 #49459
  • Upgrade to Kafka 3.9.2 #49460
  • Upgrade to Lombok 1.18.44 #49574
  • Upgrade to Maven Failsafe Plugin 3.5.5 #49461
  • Upgrade to Maven Shade Plugin 3.6.2 #49462
  • Upgrade to Maven Surefire Plugin 3.5.5 #49463
  • Upgrade to Micrometer 1.15.10 #49403
  • Upgrade to Micrometer Tracing 1.5.10 #49404
  • Upgrade to Pulsar 4.0.9 #49464
  • Upgrade to Reactor Bom 2024.0.16 #49405
  • Upgrade to Spring Batch 5.2.5 #49406
  • Upgrade to Spring Data Bom 2025.0.10 #49407
  • Upgrade to Spring Framework 6.2.17 #49408
  • Upgrade to Spring HATEOAS 2.5.2 #49586

... (truncated)

Commits
  • 285b074 Release v3.5.12
  • 6620dea Polishing
  • dd54841 Upgrade to Spring Batch 5.2.5
  • 1f2ea4a Revisit EndpointRequest matcher for additional paths
  • 01fbede Handle all requests in CloudFoundry mapping
  • dc54595 Merge pull request #49622 from dependabot[bot]
  • 9bc3768 Bump @​springio/asciidoctor-extensions in /antora
  • 6915834 Upgrade to Spring WS 4.1.3
  • a5db799 Upgrade to Spring Integration 6.5.8
  • 5ee4ffe Upgrade to JBoss Logging 3.6.3.Final
  • Additional commits viewable in compare view

Updates software.amazon.awssdk:s3 from 2.42.7 to 2.42.17

Updates org.springframework.security:spring-security-config from 6.5.8 to 6.5.9

Release notes

Sourced from org.springframework.security:spring-security-config's releases.

6.5.9

⭐ New Features

  • Update Link to CSRF Docs in FAQ #18616

🪲 Bug Fixes

  • Fix GrantedAuthority.authority null in AuthoritiesAuthorizationManager #18544
  • saveAuthenticationRequest should read relayState from authenticationRequest #18872
  • Add Missing OnCommitedResponseWrapper Header Overrides #18798
  • Clarify Resource Server startup expectations #18518
  • Correct Reference to Clear-Site-Data Directive enum #18273
  • Fix CookieRequestCache parameters #18857
  • Fix Flaky Crypto Tests #18841
  • Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs #18896

🔨 Dependency Upgrades

  • Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs #18854
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 #18809
  • Bump ch.qos.logback:logback-classic from 1.5.29 to 1.5.32 #18749
  • Bump com.fasterxml.jackson:jackson-bom from 2.18.5 to 2.18.6 #18779
  • Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16 #18876
  • Bump org-apache-maven-resolver from 1.9.25 to 1.9.26 #18750
  • Bump org-apache-maven-resolver from 1.9.26 to 1.9.27 #18791
  • Bump org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13 #18860
  • Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14 #18886
  • Bump org.hibernate.orm:hibernate-core from 6.6.42.Final to 6.6.43.Final #18780
  • Bump org.hibernate.orm:hibernate-core from 6.6.43.Final to 6.6.44.Final #18829
  • Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17 #18903

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Hann244, @​Khyojae, @​ghusta, @​itsmevichu, @​qihaiyan, @​rwinch, @​therepanic, and @​ziqin

Commits
  • 0c54a55 Release 6.5.9
  • 01ff3b0 Add Workflow for Deferring Issues
  • 33e6f4b Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
  • cdd4b36 Update Antora UI Spring to v0.4.26
  • 7672f76 Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
  • 3db4999 Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14
  • a708d2f Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17
  • e726c05 Fix Jackson 2 deserializer for AuthenticationExtensionsClientOutputs
  • a7039fb Test Jackson 2 deserializer with unknown primitive WebAuthn ext
  • 88ea668 Test Jackson 2 deserializer with unknown obj/arr WebAuthn ext
  • Additional commits viewable in compare view

Updates org.springframework.security:spring-security-core from 6.5.8 to 6.5.9

Release notes

Sourced from org.springframework.security:spring-security-core's releases.

6.5.9

⭐ New Features

  • Update Link to CSRF Docs in FAQ #18616

🪲 Bug Fixes

  • Fix GrantedAuthority.authority null in AuthoritiesAuthorizationManager #18544
  • saveAuthenticationRequest should read relayState from authenticationRequest #18872
  • Add Missing OnCommitedResponseWrapper Header Overrides #18798
  • Clarify Resource Server startup expectations #18518
  • Correct Reference to Clear-Site-Data Directive enum #18273
  • Fix CookieRequestCache parameters #18857
  • Fix Flaky Crypto Tests #18841
  • Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs #18896

🔨 Dependency Upgrades

  • Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs #18854
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 #18809
  • Bump ch.qos.logback:logback-classic from 1.5.29 to 1.5.32 #18749
  • Bump com.fasterxml.jackson:jackson-bom from 2.18.5 to 2.18.6 #18779
  • Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16 #18876
  • Bump org-apache-maven-resolver from 1.9.25 to 1.9.26 #18750
  • Bump org-apache-maven-resolver from 1.9.26 to 1.9.27 #18791
  • Bump org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13 #18860
  • Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14 #18886
  • Bump org.hibernate.orm:hibernate-core from 6.6.42.Final to 6.6.43.Final #18780
  • Bump org.hibernate.orm:hibernate-core from 6.6.43.Final to 6.6.44.Final #18829
  • Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17 #18903

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Hann244, @​Khyojae, @​ghusta, @​itsmevichu, @​qihaiyan, @​rwinch, @​therepanic, and @​ziqin

Commits
  • 0c54a55 Release 6.5.9
  • 01ff3b0 Add Workflow for Deferring Issues
  • 33e6f4b Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
  • cdd4b36 Update Antora UI Spring to v0.4.26
  • 7672f76 Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
  • 3db4999 Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14
  • a708d2f Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17
  • e726c05 Fix Jackson 2 deserializer for AuthenticationExtensionsClientOutputs
  • a7039fb Test Jackson 2 deserializer with unknown primitive WebAuthn ext
  • 88ea668 Test Jackson 2 deserializer with unknown obj/arr WebAuthn ext
  • Additional commits viewable in compare view

Updates org.springframework.security:spring-security-crypto from 6.5.8 to 6.5.9

Release notes

Sourced from org.springframework.security:spring-security-crypto's releases.

6.5.9

⭐ New Features

  • Update Link to CSRF Docs in FAQ #18616

🪲 Bug Fixes

  • Fix GrantedAuthority.authority null in AuthoritiesAuthorizationManager #18544
  • saveAuthenticationRequest should read relayState from authenticationRequest #18872
  • Add Missing OnCommitedResponseWrapper Header Overrides #18798
  • Clarify Resource Server startup expectations #18518
  • Correct Reference to Clear-Site-Data Directive enum #18273
  • Fix CookieRequestCache parameters #18857
  • Fix Flaky Crypto Tests #18841
  • Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs #18896

🔨 Dependency Upgrades

  • Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs #18854
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 #18809
  • Bump ch.qos.logback:logback-classic from 1.5.29 to 1.5.32 #18749
  • Bump com.fasterxml.jackson:jackson-bom from 2.18.5 to 2.18.6 #18779
  • Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16 #18876
  • Bump org-apache-maven-resolver from 1.9.25 to 1.9.26 #18750
  • Bump org-apache-maven-resolver from 1.9.26 to 1.9.27 #18791
  • Bump org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13 #18860
  • Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14 #18886
  • Bump org.hibernate.orm:hibernate-core from 6.6.42.Final to 6.6.43.Final #18780
  • Bump org.hibernate.orm:hibernate-core from 6.6.43.Final to 6.6.44.Final #18829
  • Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17 #18903

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Hann244, @​Khyojae, @​ghusta, @​itsmevichu, @​qihaiyan, @​rwinch, @​therepanic, and @​ziqin

Commits
  • 0c54a55 Release 6.5.9
  • 01ff3b0 Add Workflow for Deferring Issues
  • 33e6f4b Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
  • cdd4b36 Update Antora UI Spring to v0.4.26
  • 7672f76 Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
  • 3db4999 Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14
  • a708d2f Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17
  • e726c05 Fix Jackson 2 deserializer for AuthenticationExtensionsClientOutputs
  • a7039fb Test Jackson 2 deserializer with unknown primitive WebAuthn ext
  • 88ea668 Test Jackson 2 deserializer with unknown obj/arr WebAuthn ext
  • Additional commits viewable in compare view

Updates org.flywaydb:flyway-mysql from 12.0.3 to 12.1.1

Updates org.projectlombok:lombok from 1.18.42 to 1.18.44

Changelog

Sourced from org.projectlombok:lombok's changelog.

v1.18.44 (March 11th, 2026)

  • FEATURE: @Jacksonized now supports both Jackson2 and Jackson3; you'll get a warning until you configure which one (or even both!) you want lombok to generate. #3950.
  • BUGFIX: On JDK25, val and @ExtensionMethod could sometimes cause erroneous errors (in that you see errors but compilation succeeds anyway) using javac. #3947.
  • BUGFIX: @Jacksonized + fields marked transient would result in those transient fields being serialised which is surprising (and thus undesired) behaviour. #3936.
Commits
  • 17c78fe [version] pre-release version bump
  • 1edca70 [test][@Jacksonized] Test emission of warning when not choosing jackson ver...
  • e789e82 [test] Update the generation of eclipse test targets from JDK14 to JDK25.
  • a54cecd [trivial][changelog]
  • 3db0a6c [bugfix][@Jacksonized] javac handler of jacksonized checked for existing ja...
  • 12572fc [test] Adjusted tests to the new 'jackson version is a list' config key setup.
  • 0e9699c [changelog] Document implementation of Jackson3 support: #3950.
  • d441be1 [jacksonized] infrastructure for previous merge resolution: Changed to the co...
  • d62b2d5 Merge branch 'master' into cachescrubber-gh-3950
  • f49f0fe [test] Remove tests for deprecated @Logger(access = MODULE). They're deprec...
  • Additional commits viewable in compare view

Updates software.amazon.awssdk:s3 from 2.42.7 to 2.42.17

Updates org.springframework.security:spring-security-config from 6.5.8 to 6.5.9

Release notes

Sourced from org.springframework.security:spring-security-config's releases.

6.5.9

⭐ New Features

  • Update Link to CSRF Docs in FAQ #18616

🪲 Bug Fixes

  • Fix GrantedAuthority.authority null in AuthoritiesAuthorizationManager #18544
  • saveAuthenticationRequest should read relayState from authenticationRequest #18872
  • Add Missing OnCommitedResponseWrapper Header Overrides #18798
  • Clarify Resource Server startup expectations #18518
  • Correct Reference to Clear-Site-Data Directive enum #18273
  • Fix CookieRequestCache parameters #18857
  • Fix Flaky Crypto Tests #18841
  • Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs #18896

🔨 Dependency Upgrades

  • Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs #18854
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 #18809
  • Bump ch.qos.logback:logback-classic from 1.5.29 to 1.5.32 #18749
  • Bump com.fasterxml.jackson:jackson-bom from 2.18.5 to 2.18.6 #18779
  • Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16 #18876
  • Bump org-apache-maven-resolver from 1.9.25 to 1.9.26 #18750
  • Bump org-apache-maven-resolver from 1.9.26 to 1.9.27 #18791
  • Bump org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13 #18860
  • Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14 #18886
  • Bump org.hibernate.orm:hibernate-core from 6.6.42.Final to 6.6.43.Final #18780
  • Bump org.hibernate.orm:hibernate-core from 6.6.43.Final to 6.6.44.Final #18829
  • Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17 #18903

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Hann244, @​Khyojae, @​ghusta, @​itsmevichu, @​qihaiyan, @​rwinch, @​therepanic, and @​ziqin

Commits
  • 0c54a55 Release 6.5.9
  • 01ff3b0 Add Workflow for Deferring Issues
  • 33e6f4b Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
  • cdd4b36 Update Antora UI Spring to v0.4.26
  • 7672f76 Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
  • 3db4999 Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14
  • a708d2f Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17
  • e726c05 Fix Jackson 2 deserializer for AuthenticationExtensionsClientOutputs
  • a7039fb Test Jackson 2 deserializer with unknown primitive WebAuthn ext
  • 88ea668 Test Jackson 2 deserializer with unknown obj/arr WebAuthn ext
  • Additional commits viewable in compare view

Updates org.springframework.security:spring-security-core from 6.5.8 to 6.5.9

Release notes

Sourced from org.springframework.security:spring-security-core's releases.

6.5.9

⭐ New Features

  • Update Link to CSRF Docs in FAQ #18616

🪲 Bug Fixes

  • Fix GrantedAuthority.authority null in AuthoritiesAuthorizationManager #18544
  • saveAuthenticationRequest should read relayState from authenticationRequest #18872
  • Add Missing OnCommitedResponseWrapper Header Overrides #18798
  • Clarify Resource Server startup expectations #18518
  • Correct Reference to Clear-Site-Data Directive enum #18273
  • Fix CookieRequestCache parameters #18857
  • Fix Flaky Crypto Tests #18841
  • Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs #18896

🔨 Dependency Upgrades

  • Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs #18854
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 #18809
  • Bump ch.qos.logback:logback-classic from 1.5.29 to 1.5.32 #18749
  • Bump com.fasterxml.jackson:jackson-bom from 2.18.5 to 2.18.6 #18779
  • Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16 #18876
  • Bump org-apache-maven-resolver from 1.9.25 to 1.9.26 #18750
  • Bump org-apache-maven-resolver from 1.9.26 to 1.9.27 #18791
  • Bump org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13 #18860
  • Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14 #18886
  • Bump org.hibernate.orm:hibernate-core from 6.6.42.Final to 6.6.43.Final #18780
  • Bump org.hibernate.orm:hibernate-core from 6.6.43.Final to 6.6.44.Final #18829
  • Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17 #18903

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Hann244, @​Khyojae, @​ghusta, @​itsmevichu, @​qihaiyan, @​rwinch, @​therepanic, and @​ziqin

Commits
  • 0c54a55 Release 6.5.9
  • 01ff3b0 Add Workflow for Deferring Issues
  • 33e6f4b Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
  • cdd4b36 Update Antora UI Spring to v0.4.26
  • 7672f76 Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
  • 3db4999 Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14
  • a708d2f Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17
  • e726c05 Fix Jackson 2 deserializer for AuthenticationExtensionsClientOutputs
  • a7039fb Test Jackson 2 deserializer with unknown primitive WebAuthn ext
  • 88ea668 Test Jackson 2 deserializer with unknown obj/arr WebAuthn ext
  • Additional commits viewable in compare view

Updates org.springframework.security:spring-security-crypto from 6.5.8 to 6.5.9

Release notes

Sourced from org.springframework.security:spring-security-crypto's releases.

6.5.9

⭐ New Features

  • Update Link to CSRF Docs in FAQ #18616

🪲 Bug Fixes

  • Fix GrantedAuthority.authority null in AuthoritiesAuthorizationManager #18544
  • saveAuthenticationRequest should read relayState from authenticationRequest #18872
  • Add Missing OnCommitedResponseWrapper Header Overrides #18798
  • Clarify Resource Server startup expectations #18518
  • Correct Reference to Clear-Site-Data Directive enum #18273
  • Fix CookieRequestCache parameters #18857
  • Fix Flaky Crypto Tests #18841
  • Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs #18896

🔨 Dependency Upgrades

  • Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs #18854
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 #18809
  • Bump ch.qos.logback:logback-classic from 1.5.29 to 1.5.32 #18749
  • Bump com.fasterxml.jackson:jackson-bom from 2.18.5 to 2.18.6 #18779
  • Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16 #18876
  • Bump org-apache-maven-resolver from 1.9.25 to 1.9.26 #18750
  • Bump org-apache-maven-resolver from 1.9.26 to 1.9.27 #18791
  • Bump org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13 #18860
  • Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14 #18886
  • Bump org.hibernate.orm:hibernate-core from 6.6.42.Final to 6.6.43.Final #18780
  • Bump org.hibernate.orm:hibernate-core from 6.6.43.Final to 6.6.44.Final #18829
  • Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17 #18903

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Hann244, @​Khyojae, @​ghusta, @​itsmevichu, @​qihaiyan, @​rwinch, @​therepanic, and @​ziqin

Commits
  • 0c54a55 Release 6.5.9
  • 01ff3b0 Add Workflow for Deferring Issues
  • 33e6f4b Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
  • cdd4b36 Update Antora UI Spring to v0.4.26
  • 7672f76 Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
  • 3db4999 Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14
  • a708d2f Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17
  • e726c05 Fix Jackson 2 deserializer for AuthenticationExtensionsClientOutputs
  • a7039fb Test Jackson 2 deserializer with unknown primitive WebAuthn ext
  • 88ea668 Test Jackson 2 deserializer with unknown obj/arr WebAuthn ext
  • Additional commits viewable in compare view

Updates org.flywaydb:flyway-mysql from 12.0.3 to 12.1.1

Updates org.projectlombok:lombok from 1.18.42 to 1.18.44

Changelog

Sourced from org.projectlombok:lombok's changelog.

v1.18.44 (March 11th, 2026)

  • FEATURE: @Jacksonized now supports both Jackson2 and Jackson3; you'll get a warning until you configure which one (or even both!) you want lombok to generate. #3950.
  • BUGFIX: On JDK25, val and @ExtensionMethod could sometimes cause erroneous errors (in that you see errors but compilation succeeds anyway) using javac. #3947.
  • BUGFIX: @Jacksonized + fields marked transient would result in those transient fields being serialised which is surprising (and thus undesired) behaviour. #3936.
Commits
  • 17c78fe [version] pre-release version bump
  • 1edca70 [test][@Jacksonized] Test emission of warning when not choosing jackson ver...
  • e789e82 [test] Update the generation of eclipse test targets from JDK14 to JDK25.
  • a54cecd [trivial][changelog]
  • 3db0a6c [bugfix][@Jacksonized] javac handler of jacksonized checked for existing ja...
  • 12572fc [test] Adjusted tests to the new 'jackson version is a list' config key setup.
  • 0e9699c [changelog] Document implementation of Jackson3 support: #3950.
  • d441be1 [jacksonized] infrastructure for previous merge resolution: Changed to the co...
  • d62b2d5 Merge branch 'master' into cachescrubber-gh-3950
  • f49f0fe [test] Remove tests for deprecated @Logger(access = MODULE). They're deprec...
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-starter-parent from 3.5.11 to 3.5.12

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v3.5.12

🐞 Bug Fixes

  • EndpointRequest request matcher for health groups is too complex #49648
  • "/cloudfoundryapplication" web path is not limited to Actuator #49645
  • RSocket exposes duplicate endpoint for websocket setups #49592
  • Fix EndpointRequest.toLinks() when base-path is '/' #49591
  • SpringBootContextLoader mentions class that no longer exists in message for classes or locations assertion #49518
  • "spring.main.cloud-platform=none" does not disable cloud features #49478
  • Using @AutoConfigureWebTestClient prevents separate configuration of spring.test.webtestclient.timeout from taking effect #49340
  • Ordering of 'spring.config.import' is inconsistent when defined in environment or system properties #49324
  • RouterFunctions descriptions in Actuator do not support nesting #49289
  • Maven plugin does not set '-parameters' option when processing AOT code #49268
  • SSL support with Docker Compose does not work as documented #49210
  • Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49055

📔 Documentation

  • List all supported colors when describing color-coded log output #49561
  • Clarify that running is the only supported input state when triggering a Quartz job through the Actuator endpoint #49506
  • Tutorial in the reference guide has outdated instructions #49411
  • Javadoc of JettyHttpClientBuilder refers to the wrong type #49364
  • Example spring-devtools.properties file is shown in the wrong format #49357
  • Mention using org.springframework.boot.aot Gradle plugin directly for AOT processing with the JVM #49307
  • Update CLI's INSTALL.txt to reflect Groovy no longer being bundled #49297
  • JDK requirement for the CLI still refers to Java 8 #49290
  • Java and Kotlin samples of an environment post processor are inconsistent #49282
  • Document additional repositories required for shibboleth.net #49260
  • Clarify inferred relationships between OAuth 2 registrations and providers #49240

🔨 Dependency Upgrades

  • Upgrade to DB2 JDBC 12.1.4.0 #49544
  • Upgrade to Hibernate 6.6.44.Final #49457
  • Upgrade to Jakarta XML WS 4.0.3 #49458
  • Upgrade to JBoss Logging 3.6.3.Final #49630
  • Upgrade to Jetty 12.0.33 #49459
  • Upgrade to Kafka 3.9.2 #49460
  • Upgrade to Lombok 1.18.44 #49574
  • Upgrade to Maven Failsafe Plugin 3.5.5 #49461
  • Upgrade to Maven Shade Plugin 3.6.2 #49462
  • Upgrade to Maven Surefire Plugin 3.5.5 #49463
  • Upgrade to Micrometer 1.15.10 #49403
  • Upgrade to Micrometer Tracing 1.5.10 #49404
  • Upgrade to Pulsar 4.0.9 #49464
  • Upgrade to Reactor Bom 2024.0.16 #49405
  • Upgrade to Spring Batch 5.2.5 #49406
  • Upgrade to Spring Data Bom 2025.0.10 #49407
  • Upgrade to Spring Framework 6.2.17 #49408
  • Upgrade to Spring HATEOAS 2.5.2 #49586

... (truncated)

Commits
  • 285b074 Release v3.5.12
  • 6620dea Polishing
  • dd54841 Upgrade to Spring Batch 5.2.5
  • 1f2ea4a Revisit EndpointRequest matcher for additional paths

@dependabot
Bump the backend-prod group across 2 directories with 7 updates
a5196f4 
Bumps the backend-prod group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.springframework.boot:spring-boot-starter-parent](https://github.com/spring-projects/spring-boot) | `3.5.11` | `3.5.12` |
| software.amazon.awssdk:s3 | `2.42.7` | `2.42.17` |
| [org.springframework.security:spring-security-config](https://github.com/spring-projects/spring-security) | `6.5.8` | `6.5.9` |
| [org.springframework.security:spring-security-core](https://github.com/spring-projects/spring-security) | `6.5.8` | `6.5.9` |
| [org.springframework.security:spring-security-crypto](https://github.com/spring-projects/spring-security) | `6.5.8` | `6.5.9` |
| org.flywaydb:flyway-mysql | `12.0.3` | `12.1.1` |
| [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.42` | `1.18.44` |

Bumps the backend-prod group with 7 updates in the /server directory:

| Package | From | To |
| --- | --- | --- |
| [org.springframework.boot:spring-boot-starter-parent](https://github.com/spring-projects/spring-boot) | `3.5.11` | `3.5.12` |
| software.amazon.awssdk:s3 | `2.42.7` | `2.42.17` |
| [org.springframework.security:spring-security-config](https://github.com/spring-projects/spring-security) | `6.5.8` | `6.5.9` |
| [org.springframework.security:spring-security-core](https://github.com/spring-projects/spring-security) | `6.5.8` | `6.5.9` |
| [org.springframework.security:spring-security-crypto](https://github.com/spring-projects/spring-security) | `6.5.8` | `6.5.9` |
| org.flywaydb:flyway-mysql | `12.0.3` | `12.1.1` |
| [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.42` | `1.18.44` |



Updates `org.springframework.boot:spring-boot-starter-parent` from 3.5.11 to 3.5.12
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.11...v3.5.12)

Updates `software.amazon.awssdk:s3` from 2.42.7 to 2.42.17

Updates `org.springframework.security:spring-security-config` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.springframework.security:spring-security-core` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.springframework.security:spring-security-crypto` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.flywaydb:flyway-mysql` from 12.0.3 to 12.1.1

Updates `org.projectlombok:lombok` from 1.18.42 to 1.18.44
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.42...v1.18.44)

Updates `software.amazon.awssdk:s3` from 2.42.7 to 2.42.17

Updates `org.springframework.security:spring-security-config` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.springframework.security:spring-security-core` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.springframework.security:spring-security-crypto` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.flywaydb:flyway-mysql` from 12.0.3 to 12.1.1

Updates `org.projectlombok:lombok` from 1.18.42 to 1.18.44
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.42...v1.18.44)

Updates `org.springframework.boot:spring-boot-starter-parent` from 3.5.11 to 3.5.12
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.11...v3.5.12)

Updates `org.springframework.boot:spring-boot-starter-parent` from 3.5.11 to 3.5.12
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.11...v3.5.12)

Updates `software.amazon.awssdk:s3` from 2.42.7 to 2.42.17

Updates `org.springframework.security:spring-security-config` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.springframework.security:spring-security-core` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.springframework.security:spring-security-crypto` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.flywaydb:flyway-mysql` from 12.0.3 to 12.1.1

Updates `org.projectlombok:lombok` from 1.18.42 to 1.18.44
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.42...v1.18.44)

Updates `software.amazon.awssdk:s3` from 2.42.7 to 2.42.17

Updates `org.springframework.security:spring-security-config` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.springframework.security:spring-security-core` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.springframework.security:spring-security-crypto` from 6.5.8 to 6.5.9
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.8...6.5.9)

Updates `org.flywaydb:flyway-mysql` from 12.0.3 to 12.1.1

Updates `org.projectlombok:lombok` from 1.18.42 to 1.18.44
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.42...v1.18.44)

Updates `org.springframework.boot:spring-boot-starter-parent` from 3.5.11 to 3.5.12
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.11...v3.5.12)

---
updated-dependencies:
- dependency-name: org.springframework.boot:spring-boot-starter-parent
  dependency-version: 3.5.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: software.amazon.awssdk:s3
  dependency-version: 2.42.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-config
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-core
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-crypto
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.flywaydb:flyway-mysql
  dependency-version: 12.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: software.amazon.awssdk:s3
  dependency-version: 2.42.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-config
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-core
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-crypto
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.flywaydb:flyway-mysql
  dependency-version: 12.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.boot:spring-boot-starter-parent
  dependency-version: 3.5.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.boot:spring-boot-starter-parent
  dependency-version: 3.5.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: software.amazon.awssdk:s3
  dependency-version: 2.42.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-config
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-core
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-crypto
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.flywaydb:flyway-mysql
  dependency-version: 12.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: software.amazon.awssdk:s3
  dependency-version: 2.42.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-config
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-core
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.security:spring-security-crypto
  dependency-version: 6.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.flywaydb:flyway-mysql
  dependency-version: 12.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.springframework.boot:spring-boot-starter-parent
  dependency-version: 3.5.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Mar 20, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Mar 23, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Mar 23, 2026
@dependabot dependabot bot deleted the dependabot/maven/backend-prod-535e11cf65 branch March 23, 2026 11:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants